The ForumWP – Forum & Discussion Board plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient sanitization of the user’s display name field. An attacker who can log in as a Subscriber or higher can inject arbitrary JavaScript into the display name. When a victim views a page that renders the injected name, the scripts execute in the victim’s browser, enabling data theft, session hijacking, or other client‑side attacks.

All installations using ForumWP version 2.1.6 or earlier, including the 2.1.5 tags cited in the advisory, are affected. The plugin is distributed by UltimateMember and deployed on WordPress sites that have enabled user profiles or discussion boards.

The vulnerability is scored CVSS 6.4, indicating a moderate risk. Its EPSS score is below 1 %, suggesting that exploitation is unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. An attacker must be authenticated as a user with at least Subscriber privileges; the typical attack path involves editing the display name either through the user profile page or the forum member area, after which injected scripts run when other users view the profile or forum post. The limited authentication requirement reduces the attack surface, yet once compromised accounts can be used to spread malicious payloads to other site visitors.